Providing secure connections for data transmission

ABSTRACT

The disclosed system and method allow secure packet transmission to be provided with a minimum amount of overhead and to employ a cache having copies distributed among a plurality of different locations. SSL/TLS session information for a session with each of the proxy servers is stored in the cache so that it is accessible to at least one other proxy server. Using this arrangement, when a client computer switches from a connection with a first proxy server to a connection with a second proxy server, the second proxy server can retrieve SSL/TLS session information from the cache corresponding to the SSL/TLS communication session between the client device and the first proxy server. The second proxy server can then use the retrieved SSL/TLS session information to accept a session with the client device.

RELATED APPLICATIONS

This application is a continuation and claims the priority benefit ofU.S. patent application Ser. No. 09/783,146 filed Feb. 13, 2001 now U.S.Pat. No. 7,360,075 and entitled “Method & Apparatus for Providing SecureStreaming Data Transmission Facilities Using Unreliable Protocols,”which is a continuation-in-part application of the copending U.S. patentapplication Ser. No. 09/782,593 filed Feb. 12, 2001 now U.S. Pat. No.7,353,380 and entitled “Method And Apparatus For Providing SecureStreaming Data Transmission Facilities Using Unreliable Protocols” thedisclosures of which are herein by reference for all purposes. Thisapplication is also related to the copending U.S. patent applicationSer. No. 09/783,147 filed Feb. 13, 2001 and entitled “Distributed CacheFor State Transfer Operations,” the disclosure of which is incorporatedherein by reference for all purposes.

BACKGROUND OF THE INVENTION

1. Technical Field

This invention relates generally to data transmission schemes andprotocols. More particularly, the invention provides a method andapparatus for securely transmitting data between two or more computernodes using an unreliable protocol such as User Datagram Protocol (UDP).Moreover, the invention provides a method and apparatus by which acommunication session with a computer using the secure transmission ofthe invention can be switched to another computer without having togenerate a new session.

2. Related Information

The well-known Transmission Control Protocol/Internet Protocol (TCP/IP)has been used for many years to transmit data packets between computers.TCP provides a guaranteed delivery and ordering scheme for data packets,such that two or more computers using TCP can rely on the protocol toensure that any given packet will reach its destination in the order inwhich it was transmitted. Internet Protocol (IP) generally provides apoint-to-point packet transmission service without guaranteed delivery.FIG. 1A shows how an application program can be layered on top of TCP/IPaccording to a conventional protocol stack. The popular Hyper TextTransport Protocol (HTTP) relies on the existence of a TCP connectionbetween a client's browser and a server computer in order to fetch anddisplay web pages.

Although TCP provides guaranteed delivery capabilities using built-inmechanisms (i.e., each application need not concern itself withreliability details), one disadvantage of using TCP is that it can incurdelays and other side effects when transmitting a stream of data. Forexample, if two computers use TCP to transmit a packetized video stream,the received packets may appear “jerky” because missing or droppedpackets must be re-transmitted before they can be re-ordered into thereceived packet stream. Consequently, TCP is not a good candidate forstreaming data, such as videoconferencing applications.

The well-known User Datagram Protocol (UDP) provides a packet-orientedtransmission service for communicating between two computers, such as aclient computer and a server computer. In contrast to TCP and otherguaranteed-delivery protocols, packets transmitted using UDP are notguaranteed to arrive at the destination computer. Moreover, packets thatare transmitted in a particular order may arrive at the destinationcomputer out of order. Thus, UDP is termed an “unreliable” transportprotocol. In contrast to TCP and other guaranteed-delivery protocols,however, UDP provides a more time-sensitive delivery scheme, making itmore suitable for streaming media such as video data.

As applications such as videoconferencing have increased the importanceof streaming media, a need has arisen to provide secure streamingtransmission facilities. For example, many corporations need to transmitstreaming video between a headquarters facility and one or more remoteoffices. The transmission may include sensitive information that thecompany needs to protect from unintended recipients or eavesdropping.Because neither TCP nor UDP provide such security, they may beinsufficient in themselves for such transmissions.

In recent years, various attempts have been made to provide securetransmission facilities by enhancing guaranteed-delivery protocols withencryption techniques. For example, the Secure Sockets Layer (SSL) is aprotocol that provides a secure channel between two machines, such as aserver computer and a client computer. The secure channel is transparentyet encrypted between client and server, such that nearly any protocolthat can be run over TCP can be run over SSL with only minimalmodifications. Indeed, SSL/TLS security and fault detection rely on TCP(or a similar guaranteed delivery protocol) to order packets andguarantee delivery. After undergoing various revisions, SSL was renamedTransport Layer Security (TLS) and adopted by the Internet EngineeringTask Force (IETF), as reflected in RFC 2246. (The term SSL/TLS will beused to refer collectively to these two closely related protocols). Aprincipal application of SSL/TLS is on-line shopping, wherein consumerstransmit sensitive credit card information using HTTP protocols and webbrowsers in a secure manner.

Because most Internet protocols operate over TCP connections, SSL/TLSprovides a convenient scheme for securely transmitting data between twoor more computers, such as a client computer and a server computer. FIG.1B shows architecturally how an application can use SSL/TLS to transmitsecure data over a reliable connection such as TCP. As is conventional,the steps for securely transmitting data using SSL/TLS generally includethe following:

(1) a client establishes a TCP connection with a server computer;

(2) the client and server use SSL/TLS protocols to exchange credentials(including an SSL/TLS handshake; negotiation of protocol mechanisms; andestablishment of per-connection keys); and

(3) each HTTP request (e.g., GET) is converted into an SSL/TLS recordhaving encrypted content.

FIG. 1C shows a sample SSL/TLS record, which generally includes a header(HDR), encrypted data or ciphertext, and a MAC (Message AuthenticationCheck). The MAC ensures message integrity by means of a keyed hash,similar to a strong checksum, and is generally calculated as a functionMAC=h(key, plaintext, sequence number), where the sequence number is aone-up counter for successive records. The sequence number forms animportant aspect of the MAC calculated by TLS, since it preventsso-called “splicing attacks” that could otherwise occur if a hackerattempted to intercept and re-order packets in an attempt to decrypt ordisrupt secure communication between computers using TLS. If therecipient's TLS detects an incorrect sequence number for a receivedrecord, it will reject the record as an attempted breach and terminatethe connection. This requires that the sender and recipient re-establishanother TCP connection, which results in wasted time and resources.

Because of its transparent nature, any TCP-based protocols (e.g., HTTP,FTP, etc.) or any similar guaranteed delivery protocol can be operatedover TLS. Further details of SSL and TLS are provided in a book entitled“SSL and TLS: Designing and Building Secure Systems,” by Eric Rescorla,ISBN 0-201-61598-3, published by Addison Wesley.

Unfortunately, reliance on TCP or other guaranteed-delivery protocolsrenders SSL/TLS susceptible to the same performance problems that TCPincurs. For example, using SSL/TLS to transmit streaming video dataincurs the same costs and penalties (e.g., “jerky” video) that theunderlying TCP incurs. By its nature, SSL/TLS requires the use of areliable connection such as provided by TCP, because they will terminatea connection if a packet is dropped or received out-of-order.

In recent years, a protocol known as Private Communication Technology(PCT) was proposed, although it was never commercially successful. PCTwas an attempt to extend SSL to secure datagram traffic (using so-called“stream cipers”). For example, PCT used a different header format (4bytes, 2 length and 2 record type) from SSL (5 bytes, 1 record type, 2version number, 2 length). The handshaking message bodies also containeda different beginning format; PCT used 4 bytes (2 handshake type, 2record flags), while SSL uses only 1 byte (handshake type). PCT datagramsupport used the following format:

2 bytes of key_length (key_length) bytes of key data (data_length) bytesof encrypted data (mac_length) bytes of MAC data,whereas SSL's datagram support is formatted as follows:

(data_length) bytes of encrypted data (mac_length) bytes of MAC(padding_length) bytes of padding 1 byte of padding_length(nonce_length) bytes of nonce.PCT specified a mechanism in which every datagram has a new encryptionkey created by hashing a master key with the ENCRYPTED_KEY_(—)1_DATA (arandom value is assigned to each record that is part ofDK_ENCRYPTED_KEY_DATA).

The proposed PCT mechanisms imposed various performance tradeoffs. Forexample, although the PCT mechanism could be used with stream ciphers,it is likely to be much slower, because of additional hashing and keyschedule creation to process every single record. In other words, ituses a different key for every datagram, which is computationallycostly. Key schedule setup can be expensive for some block ciphers.Moreover, PCT did not provide a mechanism for integration with the SOCKSor other multiprotocol proxies.

Conventional wisdom states that UDP is not suitable for securecommunications. The Rescorla book identified above, for example,specifically states that “UDP does not [provide reliable transport] andso SSL cannot be successfully run over UDP, because records might bearbitrarily lost or reordered, which would look like an active attack tothe SSL implementation.” Consequently, the prior art teaches away fromusing UDP in combination with SSL to transmit secure data. Yet UDP wouldbe a good match for many streaming media applications, which cantolerate occasionally dropped data packets, but not delays that occur inTCP. For example, a videoconference that is broadcast in real-time cantolerate an occasionally missing video frame, but not the “jerkiness”that occurs when missing packets are retransmitted and reordered.Moreover, user session terminations occur frequently with standard UDPsent over standard SSL.

Some protocols rely on both TCP and UDP to transmit high-performancedata, such as video or audio streaming. REALAUDIO, for example, isbelieved to use both TCP and UDP, wherein TCP is used for signaling(e.g., start/stop), while UDP is used to transmit data packets for thestreaming content. However, the UDP datagrams are transmitted “in theclear,” rendering them susceptible to interception or attack.

A protocol known as KERBEROS, used mainly in academic circles, providessecurity by encrypting UDP datagrams. The mechanism used by KERBEROS toprovide datagram security is specified in RFC 1964. However, it is notcompatible with SSL/TLS protocols, and thus has not found widespreaduse. One of the primary reasons that KERBEROS has not been commerciallysuccessful is that it is complex to operate, and not streamlined forwidespread use in network processing. In particular, network-basedsecurity software must interoperate efficiently with web servers andproxy servers to control and secure user access. In general, simplerprotocols have been favored for fast processing and distributed systems.

KERBEROS also uses separate encryption mechanisms, namely keyestablishment handshakes, to communicate secure UDP and TCP traffic.However, it may be desirable to reduce computational and network trafficoverhead by integrating those under a single standard security protocol,such as SSL, running on a multiprotocol proxy server standard such asSOCKS. KERBEROS also adds a random key field for packet identificationto extend the data record in a conventional manner, for purposes ofinitializing the encryption algorithm. However, this requires additionalcomputation and network traffic as KERBEROS has a separate sequencenumber in the data record. It may be advantageous in some systems tohave a single field serving both purposes.

UDP and SSL are standards in the software industry. UDP is used forprocessing datagrams, while SSL provides secure communication. At thesame time, the adoption of multiprotocol proxy servers, such as thoserunning the popular SOCKS protocol, provide a means for combiningindustry standard communications protocols such as TCP and UDP in onesystem. Until recently, it has not been possible to do so because of theincompatibility of UDP and SSL. To understand this problem and thelimitations it creates for management of network communications under asingle proxy server protocol such as SOCKS, it is first necessary tounderstand how SOCKS processes information.

The SOCKS protocol provides a generic proxying protocol for traversingfirewalls and other boundaries. Version 5 of this protocol, described inIETF RFC 1928, provides features such as authentication and UDP support.FIG. 2 shows a conventional approach for connecting to a server througha firewall by means of a proxy server and the SOCKS protocol. As shownin FIG. 2, a client computer 201 communicates with an application server203 through a proxy server 202. The system may include a firewall (notshown) that acts as an application-layer gateway between networks.Application server 203 typically offers TELNET, FTP, SMTP, and HTTPaccess. Client computer 201 includes an application 2011 (e.g., a webbrowser) and a SOCKS client 2012. Proxy server 202 includes a SOCKSserver 2021 and a proxy function 2022. In accordance with SOCKS version5, which provides security features, client application 2011 can obtainservices from server 203 as follows.

First, client application 2011 makes a request to connect to server 203.Next, SOCKS client 2012 detects the requested connection, and is awarethat communication with server 203 must be handled via proxy server 202.Consequently, SOCKS client 2012 sends a request to SOCKS server 2021 toestablish a TCP connection. Proxy function 2022 establishes a connectionwith server 203, and all further communication between clientapplication 2011 and server 203 goes through SOCKS server 2021 and proxyfunction 2022. As is conventional, SOCKS uses SSL/TLS to establish asecure connection with client 201, and may demand a password beforepermitting the connection to be established. The architecture of FIG. 2restricts access to server 203 at a single point (e.g., proxy server202) and carries some of the load of communicating with server 203 in away that penetrates firewalls. Because they rely on SSL/TLS to providesecurity, the connections in FIG. 2 necessarily rely on TCP (or asimilar guaranteed-delivery protocol).

The architecture of FIG. 2 can also be used to transmit nonsecure UDPdatagrams. This scheme involves negotiating a UDP port “connection”between client 201 and proxy server 202, such that nonsecure UDPdatagrams are transmitted through the port, whereas secure commands aretransmitted over the secured SSL/TLS/TCP connection. Such a scheme hassometimes been referred to as “naked UDP” mode, reflecting the fact thatthe UDP datagrams are unsecure. A system employing this technique hasbeen commercially available from Aventail Corporation of Seattle, Wash.,for several years. In general, SOCKS client 2012 adds a SOCKS header toeach record transmitted from client 201, which is stripped off by SOCKSserver 2021 before being transmitted to server 203.

As described above, it is not possible to securely transmit UDPdatagrams in the context of SSL/TLS, due to SSL/TLS's reliance on TCP toprovide a reliable connection service. However, it would be advantageousto provide a secure UDP service in the scheme of FIG. 2, such that proxyserver 202 could facilitate high-performance video streaming betweenclient 201 and server 203 without compromising the security of the data.Consequently, one challenge is to find a way to operate both secure TCPand secure UDP through proxy server 202, preferably using SSL as thesecurity layer and SOCKS as the multiprotocol proxy server. Moregenerally, it would be desirable to find a way to retain compatibilitywith the SSL/TLS standard without incurring the overhead anddisadvantages caused by their reliance on TCP.

In addition to being unable to be successfully run over UDP, the SSL/TLSprotocols offer another drawback. In the example described above, theclient device 201 initiates a secure protocol session with the proxyserver 202 by completing a full SSL/TLS “handshake” with the proxyserver 202. During this handshake, the client computer 201 and the proxyserver 202 exchange SSL/TLS version numbers, cipher settings,session-specific data, authentication certificates, and otherinformation that they need to communicate with each other using theSSL/TLS protocol. Using this information, both the client computer 201and the proxy server 202 generate the same master secret key, which inturn is used to generate individual session keys. These session keys aresymmetric keys used to encrypt and decrypt individual groups ofinformation exchanged during the session, and to verify the integrity ofexchanged information.

As will be appreciated by those of ordinary skill in the art, conductinga full SSL/TLS handshake to initiate a SSL/TLS session is time consumingand presents a heavy load on the network's resources, both in terms ofnetwork communication traffic and in processing time for the clientdevice 201 and the proxy server 202. Once the proxy server 202 hasreceived the required SSL/TLS session information in a full SSL/TLShandshake, however, the proxy server 202 may subsequently resume thatSSL/TLS session with the client computer 201 using only a partialSSL/TLS handshake. Advantageously, the partial SSL/TLS handshake is muchquicker and consumes less network resources than the full SSL/TLShandshake.

A problem with this arrangement occurs, however, if the connectionbetween the client computer 201 and the proxy server 202 is terminatedand the client computer 201 then tries to establish communication withthe application server 203 through another proxy server 202. Forexample, the first proxy server 202 may have failed and be unavailable,or a load balancer may simply have routed the new connection from theclient device 201 to the new proxy server 202 to reduce thecommunication load on the first proxy server 202. In any case, the newproxy server 202 will not have the SSL/TLS session information needed toresume the SSL/TLS session with the client computer 201. Accordingly,the client device 201 and the new proxy server 202 must conduct a fullSSL/TLS handshake in order to create a new SSL/TLS communicationsession. This process is time-consuming, and may require a substantialamount processing time from both the client computer 201 and the newproxy server 202. Moreover, depending upon the state of the originalsession between the client device 201 and the proxy server 202, the lossof the previous session's state may be irreplaceable. For example, ifthe state of the earlier session was established by exchanging data thatcannot be duplicated, then that session cannot be recreated.

To address this problem, some network systems attempt to ensure that aterminated connection between a client computer 201 and its associatedproxy server 202 is reestablished with that original proxy server 202rather than with a new proxy server device 202. For example, somesystems design a load balancer to recognize when the client device 201has established a session with a particular proxy server 202, and thenroute all future connections from the client computer 201 to that proxyserver 202. This solution has a number of drawbacks, however. Itrequires that the load balancer be very complex and perform a variety offunctions. Further, it does not address the situation that occurs if theinitial proxy server 202 becomes unavailable, e.g., if it fails andsimply cannot reestablish a connection with the client computer 201. Italso does not address the situation where the first proxy server 202becomes overloaded with connections to other client computers. Ineffect, this solution may prevent the load balancer from performing aload balancing function.

In view of the failure of conventional attempts to providing secure datatransmission facilities without incurring the penalties and overheadinherent in reliable communication protocols, there exists a need toprovide such facilities to support high-bandwidth applications such assecure videoconferencing. Moreover, there is a need to provide securedata transmission services while retaining compatibility with SSL/TLS.Further, there is a need for a network arrangement that will allow aclient computer to switch between a communication connection with afirst proxy server to a second proxy server while maintaining the stateof a SSL/TLS session established between the client computer and thefirst proxy server. Preferably, such a network arrangement should permitsuch a switch from a connection with a first proxy server to aconnection with a second proxy server even if the first proxy serverbecomes unavailable due to failure or other problems.

SUMMARY OF THE INVENTION

The present invention overcomes the aforementioned problems by providinga method and apparatus for transmitting encrypted data over anunreliable protocol, such as UDP. In one variation, a special bit is setin data records which, when received by a proxy server, causes therecords to be diverted to special processing. The special processing mayinclude use of a nonce to detect the existence of repeat records and useof an initialization vector that permits the proxy server to decrypt arecord without reference to data in any other record. Data records thatdo not have the special bit set are processed according to conventionalSSL/TLS processing.

Further, the invention provides a network arrangement that employs acache having copies distributed among a plurality of differentlocations. According to the invention, SSL/TLS session information for asession with any of the proxy servers is stored in the cache so that itis accessible to at least one other proxy server. Using thisarrangement, when a client device switches from a connection with afirst proxy server to a connection with a second proxy server, thesecond proxy server can retrieve SSL/TLS session information from thecache corresponding to the SSL/TLS communication session between theclient device and the first proxy server. The second proxy server canthen use the retrieved SSL/TLS session information to accept a sessionwith the client device. According to some embodiments of the invention,identical copies of the cache are stored for each proxy server in thenetwork arrangement, and each proxy server accesses its own copy of thecache to obtain necessary SSL/TLS session information. With otherembodiments of the invention, a copy of the cache is maintained at asingle source (e.g., a redundant set of cache storage devices) that isaccessible to all of the proxy servers in the network arrangement.

Other features and advantages of the invention will become apparent withreference to the following detailed description and the figures.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1A shows a conventional approach for transmitting data packetsusing either TCP or UDP in combination with IP.

FIG. 1B shows a conventional approach for transmitting secure data usingSSL/TLS in combination with TCP/IP.

FIG. 1C shows a conventional record format for SSL/TLS record, includinga header field, an encrypted ciphertext field, and a messageauthentication check (MAC).

FIG. 2 shows a conventional approach for interfacing a client computer201 to a server computer 203 through a proxy server 202 using the SOCKSprotocol.

FIG. 3A shows a system employing a modified SOCKS protocol in anoutbound flow direction according to one variation of the invention.

FIG. 3B shows a system employing a modified SOCKS protocol in an inboundflow direction according to one variation of the invention

FIG. 4A shows a conventional technique for creating SSL/TLS recordsusing encryption.

FIG. 4B shows a conventional technique for decrypting SSL/TLS records inreliance on previously decrypted records.

FIG. 5A shows a modified encryption scheme according to one variation ofthe invention, wherein each record is encrypted independently of apreviously transmitted record.

FIG. 5B shows a modified decryption scheme according to one variation ofthe invention, wherein each record is decrypted independently of apreviously received record.

FIG. 5C shows a modified decryption scheme including multiple cipherblocks within a single record.

FIG. 6 shows various steps of a method that can be used to create andtransmit encrypted records according to various principles of theinvention.

FIGS. 7A and 7B illustrate two networks according to one embodiment ofthe invention.

FIGS. 8A and 8B illustrate two networks according to another embodimentof the invention.

FIG. 9 illustrates a proxy server device according to one embodiment ofthe invention.

FIGS. 10A and 110B illustrate a network flow level detection techniqueaccording to an embodiment of the invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

FIG. 3A shows a system employing a modified SOCKS protocol in anoutbound (e.g., from client to application server) direction accordingto one variation of the invention. As shown in FIG. 3A, a clientcomputer 301 communicates with an application server 303 through a proxyserver 302. As in the conventional system of FIG. 2, the client computerincludes a client application 3011 that communicates with a SOCKS client3012. However, in contrast to the conventional system of FIG. 2, SOCKSprocessing is modified to perform additional and different functionsfrom those in the system of FIG. 2, as described in more detail below.Application server 303 operates in the same manner as that describedwith reference to FIG. 2.

In contrast to the system of FIG. 2, proxy server 302 includes two typesof SOCKS processing: a conventional SOCKS processing function 3022, anda modified SOCKS processing function 3023. Record detector 3021 receivesserver-bound records from SOCKS client 3012 and, depending on whether aparticular bit has been set indicating that the records are “secure UDP”records, routes them through a software switch to either conventionalSOCKS processing function 3022 or modified SOCKS processing function3023. Details of modified SOCKS processing function 3023 are providedbelow.

The architecture shown in FIG. 3 allows proxy server 302 to operateeither with conventional SOCKS clients such as SOCKS client 2012 of FIG.2, or with SOCKS clients that have been modified to operate inaccordance with the principles of the present invention (modified SOCKSclient 3012), which uses unreliable protocols such as UDP to transmitencrypted data. Moreover, both types of clients can be simultaneouslyaccommodated. In one embodiment, both UDP and TCP protocols can beoperated on the same proxy server. Further details of the modifiedprocessing are provided below. Proxy function 3024 operates essentiallyin the same manner as proxy function 2022 of FIG. 2.

There are many variations on the architecture of FIG. 3 that fall withinthe inventive principles. As one example, record detector 3021 can beoptional. As another example, if client 301 and proxy server 302 agreeduring an initialization sequence that all subsequent UDP datagramsbetween them will be transmitted according to a modified encryptionscheme as described herein, it may not be necessary to flag and evaluateeach record to determine whether it conforms to one protocol or theother. It is of course also possible to implicitly designate the recordtype by way of other fields, such that the type of record (and resultingprocessing) will be evident from the other fields. Of course, as with“naked UDP,” a secure TCP message can be combined with the presentinvention to contain keys or other encryption records in support ofsecure UDP. Moreover, the functions of proxy server 302 can beincorporated into server 303 or another computer, rather than requiringa separate proxy server to implement these functions. Finally, it willbe apparent that encrypted records can be transmitted from clientcomputer 301 to proxy server 302 and vice versa, such that abi-directional secure communication path is established.

FIG. 3B shows the system of FIG. 3A for an inbound (e.g., from server toclient) flow direction. Records that are received through proxy function3024 are forwarded to SOCKS processing function 3025, which forwardsthem to a client-side record detector function 3015. Record detector3015, in response to detecting records having a secure UDP bit set,routes such records to modified SOCKS processing function 3014, andotherwise sends them to conventional SOCKS processing function 3013. Itwill be appreciated that the various SOCKS processing functions can belocated in client 301, proxy server 302, or another computer withoutdeparting from the inventive principles.

FIG. 4A shows a conventional technique for creating SSL/TLS recordsusing encryption. Before explaining how the encryption principles of thepresent invention are applied, it is first necessary to briefly reviewhow SSL/TLS performs encryption and decryption.

As shown in FIG. 4A, a first byte of plaintext 401 is encrypted using anencryption function 404, such as the conventional Data EncryptionStandard (DES). A session encryption key 402 that is shared between thesender and recipient (e.g., SOCKS client 2012 and SOCKS server 2021) andan initialization vector (IV) 403 are input to the encryption function404, and the resulting encrypted ciphertext 405 is produced. Inaccordance with the SSL/TLS standard, this ciphertext is embedded in arecord 410 including a header and a MAC that is generated via hashingfunction 411 as a function of key 407, the plaintext, and a sequencenumber that is incremented for each record. The resulting record 410 istransmitted to proxy server 302 over a TCP connection previouslyestablished as part of the initial handshaking between client 301 andproxy server 302. The first initialization vector 403 can be agreed-uponbetween the sender and recipient during initialization.

In accordance with the SSL/TLS standard, the next plaintext 406 isencrypted using the same key 402, but using ciphertext 405 generatedfrom the previously transmitted record as the second initializationvector. This creates a “link” between successive records, such that ifthe link is broken (e.g., a packet is lost or corrupted), the schemewill fail.

FIG. 4B shows the inverse process at the receiving end. At the recipientend (e.g., proxy server 202), first record 410 is decrypted as follows.The ciphertext is decrypted in decryption function 413 using apreviously shared session key 414 and a previously shared initializationvector 415. The plaintext is used in a hash function 417 in combinationwith key 420 and one-up sequence number (independently incremented bythe recipient) to generate a MAC that should match the MAC of theincoming record. If the MAC does not match, the record is discarded.

The second (and subsequent) incoming record 411 is decrypted usingsession key 414 but, instead of initialization vector 415, ciphertext410A is used as the initialization vector. This matches the counterpartencryption scheme shown in FIG. 4A. As described above, if the recipientdid not receive record 410 (or it was received out-of-order), thedecryption will not occur properly due to reliance on the “chained”initialization vectors needed for decryption. The error will be detectedby MAC comparison function 423, since the decrypted plaintext 421 willnot produce a MAC that matches the MAC in the incoming record.

As explained above, the conventional SSL/TLS reliance on previouslytransmitted data records requires that the underlying packettransmission mechanism be completely reliable. This is referred to as“cipher block chaining,” and it requires reliable transmission ofrecords because each successive data record is encrypted in reliance onthe previously generated record (with respect to DES, cipher blockchaining is defined by FIPS 81). Consequently, if a record is receivedout of order or a data record is dropped, the encryption scheme willbreak down, and the sequence numbers will not match. If this happens,according to the conventional SSL/TLS scheme, the TCP connection will beterminated and a new connection will be required to re-establish datatransmission. This security feature is intended to thwart hackers frominterfering with the secure transmission scheme by inserting ormanipulating data records between the client and proxy server. Asexplained above, if UDP or another unreliable protocol were used totransmit the data according to the scheme of FIG. 4, any missing ormis-ordered records would immediately cause the connection to be lost.Note that for the purposes of simplification, only a single block ofciphertext is shown in record 410 of FIG. 4. In practice, multipleblocks can be included in a single record, and the “cipher blockchaining” can be performed between successive blocks in the singlerecord.

FIGS. 5A and 5B show a modified encryption and decryption scheme thatcan be used according to one variation of the present invention. Inaccordance with this variation, a slightly modified SSL/TLS recordformat 507 is used. A special bit (UDP) is embedded in the conventionalheader to indicate that the record contains encrypted UDP data andshould be processed according to modified SOCKS processing function3023. This bit can be used by record detectors 3021 and 3015 todetermine whether any given SSL/TLS record should be routed toconventional SOCKS processing function 3022 or 3013, or to modifiedSOCKS processing function 3023 or 3014. This feature allows theprinciples of the invention to be applied with systems that conform tothe existing SSL/TLS/SOCKS protocol, while also allowing enhancedsecurity provisions to be used when UDP datagrams are transmitted.

As shown in FIG. 5A, plaintext 501 is encrypted using an encryptionfunction 508, such as the conventional DES encryption algorithm. Theencryption is performed using a shared session key 502 and a firstinitialization vector 503, resulting in ciphertext 505, which is used tocreate a modified SSL/TLS record 507. Plaintext 501 is also used incombination with different key 530 and a first nonce value 504 to createa MAC 509 using hashing function 506. In contrast to the encryptionscheme of FIG. 4A, the record 507 includes nonce value 504 andinitialization vector 503, which may comprise any preferably uniquevalue (e.g., random numbers). According to one embodiment, a combinednonce/IV value is generated using a strong random number generator(e.g., one defined by the X9.62 standard, produced by the commerciallyavailable RSA BSAFE CRYPTO-C function).

In contrast to conventional SSL/TLS schemes, the nonce/IV value isexplicitly included as part of each record so that the record can bedecrypted without reliance on a previously transmitted record. Incertain embodiments, the sequence number and initialization vector canbe combined into a single value (the nonce), which can be an arbitraryor randomly generated number. In one embodiment, the nonce is the samesize as the sequence number in SSL (e.g., 8 bytes), and each value isunique (i.e., the recipient can check them against a list of previouslyreceived records). The initialization vector may comprise the same sizeas a block of cipher (e.g., 8 bytes), and each value can be unique. Inone variation, it may be desirable to create a large Hamming distancebetween difference initialization vectors (e.g., random numbers whereeach bit has a 50% chance of changing). Instead of appending separatenonces and initialization vectors, a combined nonce/IV value can beused. A cryptographically strong random-number generator can be used togenerate such numbers, such as the RSA BSAFE CRYPTO-C product sold byRSA Security, Inc.

On the right side of FIG. 5A, plaintext 510 is encrypted in a similarmanner, and a separate nonce 513 and initialization vector 514 is usedto created data record 516.

Turning to FIG. 5B, the decryption of records 507 and 516 will now bedescribed. The ciphertext from record 507 is decrypted using sharedsession key 502 and the initialization vector 508 extracted from thedata record, to produce plaintext 501. The plaintext is fed through ahash function with key 518 and the nonce 508 extracted from the datarecord, to produce a MAC that can be compared with the MAC 509 extractedfrom the record.

The second record 516 is decrypted in a similar manner, except that itdoes not rely on values in the previously transmitted record 507 toperform decryption. In this manner, dropped or mis-ordered records canstill be handled.

According to a variation of the invention illustrated in FIG. 5C,multiple cipher blocks 521 can be included in a single record, and theciphertext for each block can be decrypted with reference to theprevious cipher block. The first ciphertext is decrypted in decryptionfunction 526 using initialization vector 524, whereas successiveciphertext blocks are decrypted using the ciphertext of the previousblock (generally, encryption would operate in an inverse manner). Asingle MAC value can be calculated on the basis of concatenatedplaintext blocks 531, 532, and 533.

As described above, the nonce and IV can be combined into a singlevalue, such that the same value is used both as an IV and as a uniqueidentifier for MAC calculation.

In one variation, the explicitly transmitted nonce is used to determinewhether a previously received record has been received a second time. Ifso, the protocol optionally terminates the connection or generates awarning, since such a situation might be indicative of a hacker attackby so-called “replaying” packets.” Note that the latter is differentfrom conventional SSL/TLS, which terminates the connection if a sequencenumber is received out of order. Moreover, in certain embodiments thesequence number checking can be disabled or not used.

According to one aspect of the present invention, in contrast toconventional SSL/TLS, initialization vectors are not chained acrossrecords. Each record includes a unique initialization vector, andciphertext blocks are chained together within a record as isconventional.

The use of a special UDP bit is only one technique for identifyingrecords as conventional or modified SSL/TLS records. In one embodiment,no bit at all is needed, and the assumption is made that every recordconforms to the modified SSL/TLS protocol as described herein. In otherembodiments, different flags or methods can be used to signify that aparticular record should be processed according to the modified schemeset forth above. As one example, during the initial handshaking thatoccurs between client and proxy server, a message can be sent indicatingthat subsequent records will be received according to the aforementionedprotocol. In another embodiment, secure TCP can be used to exchange aset of MAC or IV values, equivalent to the nonce, for comparison andidentification of the data record.

It should also be recognized that unreliable protocols other than UDPcan be used to carry out the inventive principles, and the invention isnot limited to UDP datagrams. Moreover, it should be appreciated thatother encryption algorithms other than DES (e.g., AES) could be used,and the invention is not limited in this respect.

FIG. 6 shows various steps of a method that can be used to practice theprinciples of the invention. Note that the use of proxy server 302 isentirely optional, and the functions illustrated therein can of coursebe implemented in client computer 301, server computer 303, or anothercomputer. Alternatively, the inventive principles can be practiced usingany protocols that provide unreliable packet transmission (e.g.,Internet Protocol), even without the constraints of the SOCKS protocols.While the examples given above reflected transmission of secure UDP dataclient 301 to server 303, the example in FIG. 6 assumes that server 303transmits UDP datagrams to proxy server 302, which encrypts them andsends them to client 301.

Assume that a client wants to receive secure video data from anapplication server using the architecture shown in FIG. 3B. That is,server 303 will transmit a stream of unreliably transmitted data usingUDP to client 301 through proxy server 302, which will ensure that therecords are sent in encrypted form to client 301. Beginning in step 601,the client and proxy server establish a TCP connection. This step isconventional, and conforms to the SOCKS protocols. In step 602, theclient and proxy server exchange credentials (e.g., they negotiatesecurity parameters) according to conventional SSL schemes. In onevariation of the invention, client 301 and proxy server 302 also agreethat UDP datagrams will be transmitted in encrypted form according tothe principles described above. This can be done by transmitting a TCPpacket (new) indicating that secure UDP datagrams will be transmittedusing a particular port. The client can also send the server informationregarding the target application server (e.g., IP address and port).Note that although steps 601 and 602 are described as being performedusing a reliable protocol, they can of course be implemented using anunreliable protocol, as long as the information needed for theencryption steps can be shared or communicated between computers in somemanner.

In step 603, a nonce/IV is generated, using for example a random-numbergenerator. In step 604, a UDP datagram received from server 303 isencrypted using the nonce, and the other fields shown in FIG. 5 aregenerated as required. For example, each block of ciphertext can bechain-block-encrypted using the plaintext from the previous byte as theinitialization vector, and the MAC can be generated as is conventional.Moreover, the nonce can be appended to the record as illustrated in FIG.5.

In step 605, a “secure UDP” bit is set in the record header to indicatethat the record has been encrypted according to the modifiedSSL/TLS/SOCKS protocol. As explained above, this bit is optional, sincethe encryption information can be indicated in various other ways.Finally, in step 606, the record is transmitted from proxy server 302 toclient 301. In step 607, the record is received in record detector 3015and, if the secure UDP bit is set, the record is decrypted in step 609according to the modified SOCKS processing outlined above. Otherwise, instep 608 the record is decrypted according to conventional SOCKSprocessing.

Thus has been described a system and methods for transmitting datasecurely using an unreliable protocol, such as UDP. The invention can beused in a wide variety of systems and applications, includingvideoconferencing; streaming media (including audio, video, or both);bulk transfers of files; computer games over the Internet (includingnear-realtime gaming systems); Internet telephony; cellular telephonetransmission; wireless LANS; and other system. The invention can provideadvantages in the form of lower power consumption and less computerprocessing because the use of the inherently less complex and unreliablecommunication protocols (e.g., UDP, IP, and others) reduces the overheadand processing needed to transmit data securely. The invention can beused not only for communicating over the Internet, but for use in othercomputer networks, such as local area networks (e.g., Ethernet),peer-to-peer networks, and the like. It is also suitable for securingvarious data types, including nonstreaming media, although its principalapplication is with UDP traffic for streaming media.

One network arrangement 701 in which embodiments of the invention can beemployed is illustrated in FIG. 7A. The network 701 shown in FIG. 7Aincludes a number of client computers 301A, 301B, 301C, 301D . . . 301θand a plurality of proxy servers 302A, 302B, 302C, 302D . . . 302φ, eachof which is connected to an application server 303. Also, a connectionfrom each client computer 301 is carried through a communication medium702 through a firewall 703 to a load balancer 704, which then routescommunications from each client computer 301 to one of the proxy servers302A, 302B, 302C, 302D . . . 302φ for relay to the application server303. As previously noted any of the server and client computers can beimplemented on a single computing unit or distributed across multiplecomputing units. Also, multiple client and/or server devices may beimplemented on a single computing unit.

While only the single application server 303 is shown in FIG. 7A forease of understanding, the network 701 can include a number ofapplication servers 303, each communicating with a number of proxyservers 302 simultaneously. The number of client computers 301communicating with each proxy server 302 in the network 701 could be,for example, more than 100. Similarly, the network could include a largenumber (e.g., in excess of 100) of proxy servers 302A, 302B, 302C, 302D. . . 302φ (communicating with each application server 303. Thecommunication medium 702 may be any suitable medium. For example, if theclient computer 301A is configured to communicate with the proxy server302A using a Web-based communication program (e.g., a browser), then thecommunication medium 702 may be the Internet. Alternately, if the clientcomputer 301D is configured to communicate with the proxy server 302Busing a remote dial-up communication program, then the communicationmedium 702 may be a direct plain old telephone system (POTS) connection.

In this example, the client computers 301A, 301B, 301C, 301D . . . 301θcommunicate with the plurality of proxy servers 302A, 302B, 302C, 302D .. . 302φ using either a conventional SSL/TLS process for reliablecommunication protocols or the modified SSL/TLS process for unreliablecommunication protocols described in detail above. As will becomeapparent from the following description, the network arrangement 701allows a secure SSL/TLS session connection from a client computer to aproxy server be switched to another proxy server without having togenerate a new SSL/TLS session, for both sessions using the conventionalSSL/TLS procedure and the modified SSL/TLS procedure for unreliableprotocols discussed above.

Each of the proxy servers 302A, 302B, 302C, 302D . . . 302φ in thenetwork 701 includes a cache memory 705. According to the invention,each of the cache memories 705A, 705B, 705C, 705D . . . 705φ contains acopy of a cache 706. The cache 706 then contains a collection of SSL/TLSsession information based upon the various SSL/TLS communicationsessions between the multiple client computers 301A, 301B, 301C, 301D .. . 301θ and the multiple proxy servers 302A, 302B, 302C, 302D . . .302φ. For example, the cache 706 contains SSL/TLS session informationcorresponding to the SSL/TLS session between the client computer 301Aand the proxy server 302A.

SSL/TLS session information for a SSL/TLS session preferably includesall of the information necessary for a proxy server 302 to resume thatSSL/TLS session with a client computer 301 without having to generate anew SSL/TLS session. For example, the SSL/TLS session information mayinclude all of the information needed for a proxy server 302 to resume aSSL/TLS session with a client computer 301 with only a partial SSL/TLShandshake operation. Thus, the SSL/TLS session information shouldinclude the master secret key used to generate session keys forencrypting and decrypting data exchanged during the session. For variousembodiments of the invention, the SSL/TLS session information shouldalso include the peer certificate used to authenticate the clientcomputer 301 and/or the user of the client computer 301.

In addition, the SSL/TLS session information may include a sessionidentifier to identify the session (e.g., an arbitrary byte sequencechosen by the proxy application 901 to identify an active or resumablesession), a cipher specification, specifying the bulk data encryptionalgorithm (such as null, DES, etc.), the message authentication check(MAC) algorithm (such as MD5 or SHA), and the cryptographic attributes(such as the hash size) used by the client computer 301 and the proxyapplication 901. Still further, the SSL/TLS information may include thealgorithm used to compress data prior to encryption, and flaginformation indicating whether or not the session can be used toinitiate new connections.

It should be noted that the term SSL/TLS session as used herein refersto both sessions generated using the conventional SSL/TLS processes forreliable communication protocols and the modified SSL/TLS processes forunreliable communication protocol discussed above. Of course, in orderto allow a proxy server 302 to resume a SSL/TLS session withoutgenerating a new SSL/TLS session, the SSL/TLS session information mayalso include information specific to the type of SSL/TLS techniqueemployed to originally generate the session. Thus, if the SSL/TLSsession was generated using the modified SSL/TLS process for unreliablecommunication protocol discussed above, the SSL/TLS session informationmay also include data (e.g., a flag) indicating an agreement between theclient computer 301 and the proxy server 302 that all subsequent recordsexchanged during the session will be processed according to the modifiedSSL/TLS process.

Accordingly, each cache 706 stores the information necessary to resumethe SSL/TLS sessions (generated by both the convention SSL/TLS processor the modified SSL/TLS process described above) between the multipleclient computers 301A, 301B, 301C, 301D . . . 301θ and the multipleproxy servers 302A, 302B, 302C, 302D . . . 302φ. The cache 706 thusincludes the SSL/TLS information necessary to resume the SSL/TLS sessionbetween the client computer 301A and the proxy server 302A. Because eachproxy server 302 has copy of the cache 706 in its associated cachememory 705, if the connection between the client computer 301 and theproxy server 302A is terminated, the client computer 301A can establisha new session with any of the other proxy servers 302B, 302C, 302D . . .302φ with the same SSL/TLS session information as the earlier sessionbetween the client computer 301A and the proxy server 302A.

In one embodiment of the invention, each cache memory 705A, 705B, 705C,705D . . . 705φ contains a complete copy of the cache 706. As each proxyserver 302 obtains new SSL/TLS session information for a new sessionwith a client computer 301, or updated SSL/TLS session information foran existing session with a client computer 301, the proxy server 302sends the new or updated SSL/TLS session information to each copy of thecache 706 for storage.

The network 701 embodying the invention provides significant advantagesover a conventional network arrangement. Because a client computer 301can establish a session with any of the proxy servers 302 using theSSL/TLS session information obtained during a previous session, the loadbalancer 704 does not need to try to route a connection from a clientcomputer 301 back to the proxy server 302 with which it had previouslyestablished a session. Thus, the function of the load balancer 704 canbe simplified to distributing incoming communications from clientcomputers 301A, 301B, 301C, 301D . . . 301θ evenly among the availableproxy servers 302A, 302B, 302C, 302D . . . 302φ. Further, even if aproxy server 302 becomes completely unavailable (i.e., it suffers acomplete failure), the client computer 301 can establish a new sessionwith another proxy server 302 without having to recreate the SSL/TLSsession information previously obtained in the earlier session.

While the above-described embodiment maintains a complete copy of thecache 706 in each cache memory 705, other embodiments of the inventionmay keep a copy of only a portion of the cache 706 in each cache memory705 as shown in FIG. 7B. With these embodiments, however, the SSL/TLSsession information for each session should still be stored in others ofthe multiple cache memories 705A, 705B, 705C, 705D . . . 705φ so thateach proxy server 302 can access the SSL/TLS session information. Forexample, the SSL/TLS session information for the session between theclient 301A and the proxy server 302A may be stored in only the cachememory 705A (associated with proxy server 301A), cache memory 705B(associated with proxy server 301B), and cache memory 705C (associatedwith proxy server 301C). If the proxy server 302A then becomesunavailable and the client computer 301A is switched to a connectionwith the proxy server 302B, then the proxy server 302B can establish asession with the client computer 301A using the SSL/TLS sessioninformation retrieved from its own memory cache 302B.

Moreover, even if the client computer 301A is instead switched to aconnection with a proxy server that does not have the SSL/TLS sessioninformation in its cache memory (e.g., proxy server 302D), then thatproxy server can request the SSL/TLS session information from another,available proxy server 302 (e.g., proxy server 302B) that does have theappropriate SSL/TLS session information in its cache memory 705. Forexample, if the connection with the client computer 301A is switched toproxy server 302D, that proxy server 302D can sequentially request theSSL/TLS session information from the other available proxy servers 302until it receives the SSL/TLS session information in reply. Alternately,the proxy server 302D may issue simultaneous requests to all of theother available proxy servers 302, and employ, e.g., the SSL/TLS sessioninformation in the first received reply.

The above-described embodiments of the invention may be referred to aspeer configuration type embodiments, as the proxy servers 302 alone areresponsible for maintaining the cache 706. With these peer configurationembodiments of the invention maintaining copies of the entire cache 706(or copies of overlapping portions of the cache 706) in each cachememory 705A, 705B, 705C, 705D . . . 705φ requires that each proxy server302 transmit new or updated SSL/TLS session information to multiplecache memories 705 in a write process. Preferably, this write process isperformed using a reliable communication technique that requires apositive acknowledgement from the receiving device, so that each proxyserver 302 can confirm that its associated cache memory 705 hasprocessed the new or updated SSL/TLS session information. If the numberof proxy servers 302 in the network is relatively small, the type andamount of SSL/TLS session information being saved by the proxy servers302 is relatively stable, and the total amount of SSL/TLS sessioninformation in the cache 706 is relatively small, then writing thenecessary SSL/TLS session information to each cache memory 705A, 705B,705C, 705D . . . 705φ with this configuration using a reliable, positiveacknowledgement based communication technique will not create a largeresource overhead for the network 701. For example, if the network 701only has nine proxy servers 302, then writing new or updated SSL/TLSsession information to each proxy server 302 does not consume aninordinate amount of the network's resources.

If, on the other hand, the type of SSL/TLS session information stored inthe cache 706 must be updated frequently, or the network includes alarge number of proxy servers 302 (e.g., more than nine proxy servers),then writing each piece of new or updated SSL/TLS session information toevery proxy server 302 in the network using a reliable, positiveacknowledgement based communication technique may divert significantresources from the network 701. For example, as the number of clientcomputers 301 increases, even infrequent updates to multiple cachememories 705 for each client computer 301 may divert a significantamount of resources from the network 701. Similarly, as the number ofproxy servers 302 increases, writing new or updated SSL/TLS sessioninformation to the cache memory of each proxy server 302 using areliable, positive acknowledgement based communication technique maydivert a significant amount of resources from the network 701. Further,if the cache 706 becomes too large, it may be difficult to store acomplete copy of the cache in the cache memory 705 of a proxy server302.

Accordingly, a network 801 implementing yet another embodiment of theinvention is shown in FIG. 8A. As with the previously discussed networkarrangement 701, the network 801 includes a plurality of clientcomputers 301A, 301B, 301C, 301D . . . 301θ and a plurality of proxyservers 302A, 302B, 302C, 302D . . . 302φ, each of which are connectedto the application server 303. As also previously described, each clientcomputer 301 is connected to a load balancer 704 through a communicationmedium 702 and a firewall 703. The load balancer 704 routes a connectionfrom each client computer 301 to one of the proxy servers 302 (e.g.,from client computer 301A to proxy server 302A as shown in the figure).Also, as with the network 701 shown in FIG. 2, each of the proxy servers302A, 302B, 302C, 302D . . . 302φ in the network 301 has an associatedcache memory 705A, 705B, 705C, 705D . . . 705φ.

This embodiment of the invention additionally includes, however, a cacherepository 802, for storing one or more copies of the cache 706. As willbe understood from the following explanation, this embodiment is thus atwo-tiered configuration for storing the cache 706, rather than a peerconfiguration as with the previously discussed embodiments of theinvention. That is, this embodiment has one tier of SSL/TLS sessioninformation storage provided by the cache memories 705A, 705B, 705C,705D . . . 705φ of the proxy servers 302A, 302B, 302C, 302D . . . 302φ,and a second tier of SSL/TLS session information storage provided by thecache repository 802.

As seen in FIG. 8A, the cache repository 802 may include two cachememory server devices 803 and 804. Each of these cache memory serverdevices 803 and 804 stores a complete copy of the cache 706. It shouldbe noted, however, that the cache repository 802 includes the two cachememory server devices 803 and 804 for redundancy. Thus, if one of thecache memory server devices 803 and 804 fails or otherwise becomesunavailable, the cache repository 802 will still include a complete copyof the cache 706 in the remaining cache memory server device. Otherembodiments of the invention may alternately employ only a single cachememory server device as the repository 802 if redundancy is not desired,or three or more cache memory server devices if redundancy is apriority.

The cache memories 705A, 705B, 705C, 705D . . . 705φ in the embodimentof FIG. 8A might not store copies of the entire cache 706. Instead, ifthe cache 706 is larger than can be stored in the cache memories 705A,705B, 705C, 705D . . . 705φ, each cache memory 705 may store only aportion of the cache 706 that relates to its associated proxy server302. For example, the portion of the cache 706 copied into cache memory705A may only include the SSL/TLS session information for sessionsestablished with the proxy servers 301A and 301B. Thus, if the clientcomputer 301A loses its connection to the proxy server 302A, and thentries to establish a new session with the proxy server 302B, the cachememory 705B may not contain SSL/TLS session information for the earliersession with the proxy server 302A.

With this embodiment, however, when a proxy server 302 receives arequest to establish a session with a client computer 301 for which it'smemory cache 705 does not have SSL/TLS session information, the proxyserver 302 can obtain the relevant SSL/TLS session information from thecache repository 802. Thus, in the foregoing example, the proxy server302B will obtain the SSL/TLS session information for the clientcomputer's 301A previous session from the cache repository 802. The newproxy server 302 can then use the SSL/TLS session information toestablish a new session with the same SSL/TLS session information as theprevious session.

In addition to being useful where the size of the cache 706 is too largefor an entire copy of the cache 205 to efficiently be stored in thecache memory 705 of a proxy server 302, this embodiment of the inventionemploying a cache repository 802 will typically also be more efficientfor networks with very large numbers of proxy servers 302A, 302B, 302C,302D . . . 302φ (e.g., networks with more than ten proxy servers,depending upon whether the type of SSL/TLS session information beingstored in the cache 706 requires the cache 706 to be updatedfrequently). With this embodiment, each proxy server 302 will normallyneed to use a reliable, positive acknowledgement communication techniqueto write new or updated SSL/TLS session information to only the cacherepository 802, thereby reducing the amount of communication traffic(created by write operations and their confirmations) across thenetwork. The other proxy servers 302 in the network can then obtain thenew or updated SSL/TLS session information through less reliablecommunication techniques, or directly from the cache repository 802, aswill be discussed below.

It should be noted, however, that the two-tiered arrangement shown inFIG. 8A is exemplary. Those of ordinary skill in the art will appreciatethat three-tier, four-tier and other multiple tier arrangements can beemployed, depending upon the total size of the cache 706. For example,if the size of the cache 706 is too large to be efficiently stored in asingle cache memory server device 305 or 307, then two or more cacherepositories 802 can be employed, each storing a different portion ofthe cache 706. An entire copy of the cache 706 may then be stored on arelatively inefficient storage device (e.g., a bank of magnetic diskstorage devices) accessible to each of the cache repositories 802. Also,each proxy server 302 may then be associated with a particular cacherepository 802, and store some or the entire portion of the cache 706maintained by its associated cache repository 802. Various otherembodiments will be apparent to those of ordinary skill in the art.Accordingly, the term “multi-tier” will be used hereafter to refer toembodiments of the invention having two or more hierarchical levels ofdevices storing at least a portion of the cache 205.

It also should be noted that, with alternate embodiments of invention,the different portions of the cache 706A, 706B, 706C, 706D . . . 706φstored in cache memories 705A, 705B, 705C, 705D . . . 705φ may overlap.For example, the portion of the cache 705A may contain SSL/TLS sessioninformation that is also stored in the portion of the cache 705B and theportion of the cache 705C. Having some overlap between the differentportions of the cache 706 may reduce the amount of network traffic, as aproxy server 302 may already have SSL/TLS session information for a newclient computer 301 seeking connection. Further, each of the cachememories 705A, 705B, 705C, 705D . . . 705φ may contain a copy of theentire cache 706, as shown in FIG. 8B. This embodiment of the inventionmay be preferable to the embodiment shown in FIG. 8A, when, e.g., thesize of the cache 706 is sufficiently small to be stored in its entiretyin a cache memory 705.

One possible embodiment of a proxy server 302 will now be described withreference to FIG. 9. As seen in this figure, the proxy server 302includes a proxy application 901, a distributed cache applicationprogramming interface (API) 902, a distributed cache application 903, acommunicator application 904, and the cache memory 705. As will bediscussed in detail below, the proxy application 901 performs theprimary functions of the proxy server 302, and includes each of therecord detector 3021, the conventional SOCKS processing function 3022,the modified SOCKS processing function 3023, and the proxy function3024. That is, the proxy application 901 establishes securecommunication with a client computer 301, and relays messages betweenthe client computer 301 and the application server 303. The proxyapplication 901 also sends SSL/TLS session information for a sessionwith a client computer 301 to the distributed cache application 903 viathe distributed cache API 902.

The distributed cache API 902 retrieves information from the cachememory 705, and facilitates requests to send information to or deleteinformation from the cache memory 705 by passing them along to thedistributed cache application 903. The distributed cache application 903stores information in the cache memory 705, and also controls theexchange of information between the cache memory 705 other proxy servers302 (and, where applicable, the cache repository 802). The distributedcache application 903 communicates with the other proxy servers 302 (andthe cache repository 802, where applicable) through the communicatorapplication 904.

Accordingly, after completing the full SSL/TLS handshake, the proxyapplication 901 sends SSL/TLS session information obtained from the fullSSL/TLS handshake to the cache memory 705 for storage.

More particularly, the proxy application 901 may form a record forstorage in the cache 706 that includes a data field with the SSL/TLSresumption information and a key field with the SL/TLS sessionidentifier. The record may also include a time-to-live field with a timeat which the record will expire and should be removed from the cache. Inaddition, the record may include a record identifier pre-pended to thekey information (i.e., the session identifier), as will be discussedbelow. The proxy application 901 passes this record through thedistributed cache API 902 to the distributed cache application 903 forstorage in the cache memory 705.

When the proxy application 901 receives a request from a client computer301 to initiate a session, the request will include a SSL/TLS sessionidentifier if that client computer 301 has already established anSSL/TLS communication with a proxy application 901 (either the sameproxy application 901 now receiving the request or another proxyapplication 901). The proxy application 901 then passes the SSL/TLSsession identifier onto the cache API 902 as a search key, so that theAPI 902 may request the distributed cache application 903 to retrievethe SSL/TLS information from the cache memory 705 corresponding to theSSL/TLS session identifier.

As previously noted, the function of the distributed cache API 902 is toretrieve an existing record from the cache memory 705 using a GEToperation. Further, the some embodiments of the invention, thedistributed cache API 902 facilitates requests to add, delete or modifya record by passing these commands onto the distributed cacheapplication 903. Thus, the distributed cache application 903 may performADD, DELETE and UPDATE operations on the cache memory 705. Preferably,the ADD operation adds a record to the cache memory 705 based upon theinformation in the record's key field, even if the record for that keyalready exists in the cache memory 705. The DELETE operation removes arecord from the cache memory 705, while the UPDATE operation updates arecord already existing in the cache memory 705. Also, the distributedcache application 903 may have the capability forcing a purge of each ofthe cache memories 705A, 705B, 705C, 705D . . . 705φ.

It should be noted that the cache API 902 will first attempt to completea GET operation by obtaining the requested record from the local copy ofthe cache 706 (or the copy of the portion of the cache 706) from thecache memory 705. With some preferred embodiments of the invention, thisrequest will be immediately successful, as each cache memory 705 storesa complete copy of the cache 706. If the requested record is not foundin the local cache memory 705, (e.g., if the cache memory 705 containsonly a portion of the cache 706 that does not have the requested recordor a copy of the cache 706 that has been corrupted), however, then thecache API 902 will involve the distributed cache application 903 toobtain the record from another source. With the peer configuredembodiment of the invention shown in FIGS. 7A and 7B, the distributedcache application 903 will attempt to retrieve the requested record fromone or more of the other proxy servers 302. In the multi-tier configuredembodiment of the invention shown in FIGS. 8A and 8B, however, thedistributed cache application 903 may instead attempt to retrieve therequested record from the cache repository 802.

Similarly, when the distributed cache application 903 adds, updates, ordeletes a record from its local cache 705, it also relays thecorresponding add, update or delete command to other devices in thenetwork. For example, in the peer configured embodiment of the inventionshown in FIGS. 7A and 7B, the distributed cache application 903 willrelay the command to each of the other proxy servers 302. In themulti-tier configured embodiment of the invention shown in FIGS. 8A and8B, however, the distributed cache application 903 may relay the commandto the cache repository 802. The cache repository 802 may then in turnrelay the command to one or more of the other proxy servers 302. In thismanner, new or updated SSL/TLS session information obtained by the proxyapplication 901 of one proxy server 302 is conveyed to the other proxyservers 302 for use in future sessions with the client computer 301.

The storage of the SSL/TLS session information in the cache 706 by thedistributed cache application 903 will now be discussed. As will beappreciated by those of ordinary skill in the art, as the number ofproxy servers 302A, 302B, 302C, 302D . . . 302φ increases, the number ofpossible sessions between client computers and proxy servers 302A, 302B,302C, 302D . . . 302φ also increases. Accordingly, the amount of SSL/TLSsession information stored in the cache will increase as well. This istrue for both the peer distributed cache embodiment exemplified in FIGS.7A and 7B and for the multi-tiered distributed cache embodimentexemplified in FIGS. 8A and 8B. Accordingly, SSL/TLS session informationshould be stored in the cache 706 so that it can be quickly andefficiently retrieved when necessary. Some preferred embodiments of theinvention may therefore use a hash table to implement the cache 706, andemploy a hashing function to store and retrieve SSL/TLS sessioninformation from the hash table.

As is known in the art and discussed above, each piece of SSL/TLSsession information may be stored in the cache 706 as part of a record.To enter a record into a hash table, the distributed cache application903 performs a mathematical algorithm or “hash” operation on the keydata in the key field (e.g., the SSL/TLS session identifier) in order tomap the key data to a numerical value. The SSL/TLS session informationidentified by the key data is then stored in the hash table at alocation (sometimes referred to as a “bucket”) corresponding to thenumerical value against which the key data was mapped by the hashoperation.

It should be noted that different key values may hash to the same hashvalue. Thus, different records may be stored in the same location in orbucket in the hash value. Accordingly, the hash operation preferably isselected so that an even distribution of hash values is obtained for theentire range of possible key data values. This is to ensure that adisproportionate number of records are not stored at a particularlocation in the hash table. That is, it is preferable to employ a hashoperation that evenly distributes records in the hash table. Thus, whena record must be retrieved, the average retrieval time for a record fromany location in the hash table should be close to or the same as fromany other location in the hash table.

According to some preferred embodiments of the invention, the “BUZhash”hashing algorithm may be employed to evenly distribute SSL/TLS sessioninformation records in the cache 706. This hashing algorithm isdescribed in the article “Hashing Concepts and the Java ProgrammingLanguage,” by Robert Uzgalis, ©1996, which article is incorporatedentirely herein by reference. As explained in the article, the BUZhashalgorithm conventionally operates as described below using the SketchyAlgorithm Language:

unsigned long PROC buzhash ( string key ); unsigned long rtab[256] = {64-bit-rand, 64-bit-rand,... }; unsigned long h = 64-bit-rand; for ifrom 0 to size(key) h = cshift(h,1) XOR rtab[key[l]]; return h;Of course, those of ordinary skill in the art will appreciate that theBUZhash algorithm can be modified for different configurations of thecache 706 (e.g., different key ranges, etc.).

As discussed in the Uzgalis article, when applied to a binary key value,the BUZhash algorithm is particularly good at both generating a randomnumber from any given key value and distributing the possible range ofkey values evenly in a table. Those of ordinary skill in the art willappreciate, however, that other hash algorithms known in the art mayalso be employed to store the SSL/TLS session information in the cache706. Also, it will be apparent that new hash algorithms may be developedwhich can be used to store SSL/TLS session information in the cache 706.

It should be noted that the distributed cache application 903 treats allkey values opaquely, and operates under the assumption that all keyvalues are unique. That is, a unique key can only identify a singlerecord in the cache 706. If a second record is added to the cache 706with the same key data as an existing record, only one of the recordswill survive. It may be desirable, however, to use the same key data torefer to different records. For example, as previously explained, aSSL/TLS session identifier may be used as key data to identify a recordwith SSL/TLS resumption information. It may also be desirable to use theSSL/TLS session identifier to identify a different record, such as arecord with authentication information for the user employing the clientcomputer 301 (e.g., authentication information used to determine thedata that the client computer's user may access from the applicationserver 303).

Accordingly, with various embodiments of the invention the cache API 902may provide for the use of a table identifier to distinguish between twodifferent records that share the same key data. With these variousembodiments of the invention, the proxy application 901 specifies atable identifier value that is pre-pended to the key data as part of allcalls through the cache API 902 that involve the specification of keydata. This allows the proxy application 901 to, in effect, specify avirtual table to which the record identified by a particular key shouldbe written to or read from. Of course, as will be appreciated by thoseof ordinary skill in the art, because all records of the cache 706 arestored in a single hash table as described above, this is only a logicalconstruct.

Preferably, the proxy application 901 is the responsible for ensuringthat each table identifier value is properly created and consistentlyapplied. The proxy application 901 may prepend the table identifier tothe key and then pass the key to the cache API 902, or, alternatively,to omit a buffer allocation operation and a copy operation, the proxyapplication 901 may pass the table identifier to the cache API 902 andthe cache API 902 may prepend the table identifier. Because the cacheAPI 902 treats the table identifier as part of the key data, the proxyapplication 901 should preferably minimize the size of this value is asmuch as possible. Minimizing the size of the table identifier will allowfor both optimal memory usage and optimal hashing performance.

The cache memory 705 may be any type of memory medium. As will beappreciated by those of ordinary skill in the art, however, the cachememory 705 may be preferably embodied in a readable and rewritablesemiconductor memory device, commonly referred to as RAM or main memory,as this type of memory device allows information to be both quicklystored and retrieved. Currently, computers that are conventionally usedas server devices may have such memories that can store between 2gigabytes and 4 gigabytes of information. Thus, approximately 2-4million 1 kilobyte records can be stored in this type of memory devicefor each proxy server 301. Of course, other types of memory medium, suchas a magnetic medium or an optical medium, may alternately be employed.

According to some embodiments of the invention, the communicatorapplication 904 provides for point-to-point (i.e., acknowledgementbased) communication, such as a unicast or TCP/IP-like communicationbetween devices in the network. This type of communication is useful,for example, to synchronize SSL/TLS session information between a newlyinitiated cache memory 705 with an existing cache memory 705, to ensurethat all of the SSL/TLS session information is accurately copied to thenew cache memory 705 before it is used by its corresponding proxyapplication 901.

This type of point-to-point communication (e.g., unicast or TCP/IP-likecommunication) provided by the communicator application 904 can also beused by distributed cache application 903 to update or add individualrecords in the cache memories 705 of other proxy servers 302. Asdiscussed above, however, with the embodiment of the invention shown inFIGS. 7A and 7B, the overhead on the network resources for writingSSL/TLS session information to each cache memory 705 increases as thenumber of proxy servers 302 increases. This is because each proxy server302 must write new or updated SSL/TLS session information to each cachememory 705 using a separate write process, and then receive anacknowledgement of receipt of the write command from each cache memory705 in reply, requiring a significant amount of network traffic andprocessor time for each proxy server 302 in the network 701. Morespecifically, the number of data packets that must be transmitted foreach communication is 2N, where N is the number of devices (e.g., proxyservers 302) receiving the communication.

Thus, while the messages from the communicator application 904 can beindividually delivered to each appropriate recipient device in thenetwork using, e.g., point-to-point messaging, this type ofcommunication restricts the speed and efficiency of the invention.Accordingly, with some preferred embodiments of the invention, thecommunicator application 904 also provides reliable multicastcommunication. As is known in the art, a communication technique may beconsidered reliable if (a) data packets transmitted according to thetechnique are correctly ordered and duplicates can be discarded by thereceiving party, (b) the technique allows the receiving party to detectwhen data packets are missing from a transmission, and (c) the techniqueprovides a repair mechanism for the receiving party to obtain datapackets missing from a transmission. Multicasting, as is also well knownin the art, is a procedure whereby different network devices receive amessage sent to a single network address.

Therefore, the communicator application 904 may use reliable multicasttransmissions to add, update, or delete SSL/TLS session information toor from the appropriate devices in the network. By using reliablemulticasting, these embodiments of the invention advantageously conveySSL/TLS session information to a number of different devicessimultaneously, simply by transmitting the SSL/TLS session informationto a single, shared multicast address. As previously noted, the processof multicasting is well known in the art and several multicastingprotocols, such as the multicast transfer protocol (MTP), have beenestablished to facilitate multicast communications.

One type of reliable multicast communication technique is the multicastcommunication with positive application acknowledgement. With thistechnique, an application receiving the multicast transmission sends anacknowledgement back to the device originating the multicasttransmission after the application has successfully processed thetransmitted data. This type of reliable multicast communication maypreferably be employed by the communicator application 904 when relayingan ADD command from the distributed cache application 903 to add SSL/TLEsession information to other cache memories 705 in a peer configurationembodiment (or to the cache repository 802 in a multi-tier configurationembodiment). In the peer configuration embodiment, using a reliablepositive-acknowledgement multicast communication technique reduces thenumber of data packets that must be transmitted across the network foreach communication to 1+N, where N is the number of devices (e.g., proxyservers 302) receiving the communication. That is, one communication ismulticast to each of N devices, and N positive acknowledgements aretransmitted back to the originating device.

While reliable positive acknowledgement multicasting allows multipledevices to reliably receive updated or new SSL/TLS session informationsimultaneously, it may still require significant network resources toimplement with the peer configuration. Because each device receiving amulticast message will need to individually acknowledge receipt of thecommunication to the network device from which the message originated,in a network with a large number of proxy servers 302 (i.e., where Nbecomes large), transmitting SSL/TLS session information to each proxyserver 302 using reliable positive acknowledgement multicasting maystill substantially impair the performance of the network.

For various applications of the invention, however, employing themulti-tier configuration embodiments described above can reduce the useof network resources still further. With these embodiments, new orupdated state information need be transmitted to only the cacherepositories 802 using a reliable, positive-acknowledgement basedcommunication technique. The proxy servers 302 can then obtain the newor updated state information using a less-reliable (and thus typicallyless expensive in terms of network resources) communication technique,or obtain the new or updated state information from a cache repository802 when needed. Thus, by using the multi-tier configuration, the numberof packets that must be transmitted across the network for each additionof new or updated state information can be reduced still further to 1+n,where n is the number of cache repositories 802 receiving the new orupdated state information. Because the number n of cache repositories802 will typically be much smaller than the number N of proxy server 302in the invention, using the multi-tier configuration can substantiallyreduce the use of network resource, both in network traffic andprocessing time for individual resources, required to cache new orupdated state information.

With the multi-tier configurations embodiments of the invention, theproxy servers 302 may then receive new or updated state informationusing, for example, a negative acknowledgment (NACK) technique toprovide reliable multicast communication, instead of the positiveacknowledgment technique discussed above. With a negative acknowledgmentmulticast procedure, the devices receiving the multicast message do notsend an acknowledgment to the originating device upon receipt of themessage. Instead, each receiving device responds to the originatingdevice only when it determines that it has missed a portion of themulticast communication.

For example, some communication protocols require that each segment ofdata in a communication be sequentially numbered. Thus, with thenegative acknowledgement procedure, a device receiving a communicationaccording to such a protocol a might respond to the originating deviceonly when it recognized that it had not received one of the datasegments (i.e., when it determined that it was missing a sequentiallynumbered data segment). Accordingly, the communicator application 904,according to various embodiments of the invention, employs thistechnique to provide negative acknowledgements to another device in thenetwork when it recognizes that it has not received data from thatdevice.

Thus, this negative acknowledgement reliable multicast arrangement canbe used to deliver new or updated SSL/TLS session information to each ofthe proxy servers 302 in multi-multi-tier configuration embodiments ofthe invention, thereby reducing the amount of communication trafficbetween the devices. Of course, both a positive acknowledgementmulticast communication and a negative acknowledgement multicastcommunication can be accomplished using a single multicast transmissionat all of the relevant receiving devices. The device sending thetransmission will then wait until receiving positive acknowledgementsfrom all of the devices designated to communicate using the positiveacknowledgement technique before sending another multicast transmission.The sending device will then also respond to any negativeacknowledgement it receives according to the appropriate negativeacknowledgement multicast communication protocol.

Conventional negative acknowledgement reliable multicast communicationtechniques present an additional problem, however, sometimes referred toas “overrunning.” In this situation, the transmitting device sends datafaster than one or more of the receiving devices can process it,resulting in some of the transmitted data being lost. Further, thetransmitting device may send out too much information to receive anegative acknowledgment from another device indicating that a portion ofthe communication was lost. The extent of this problem is dependent uponthe flow rate of communication traffic across the network, however. Whenthere is little communication traffic over the network, however then thedevice initiating the multicast communication will be able to transmitinformation faster without overrunning a receiving device or missing anegative acknowledgement. Likewise, when the communication traffic overthe network increases, the device initiating the multicast communicationshould transmit data more slowly to avoid overrunning a receiving deviceor missing a negative acknowledgement.

To address this problem, some prior art negative acknowledgmentmulticast systems have proposed to set an absolute limit on the rate atwhich data is transmitted in a multicast communication, to ensure that anegative acknowledgment from another device is received under allcircumstances. This constant-rate solution of the prior art, however,does not take into varying communication traffic flow across thenetwork. Instead, it always operates at the lowest possible efficiencyto ensure that all negative acknowledgments are received. Other priorart systems use deterministic techniques with a “master” and “token”arrangement, but these systems are relatively slow, inefficient andcomplex.

Accordingly, with some preferred embodiments of the invention, thecommunicator application 904 may provide negative acknowledgementreliable multicast communications in conjunction with a traffic flowrate detection process for determining the flow of communication trafficacross the network. By accurately detecting the flow of communicationtraffic across the network, the communicator application 904 cancorrespondingly increase or decrease the rate at which it transmits datain the reliable negative acknowledgement multicast communication. Thisflow rate detection process will now be discussed with reference toFIGS. 10A and 10B.

As shown in these figures, the communicator application 904 has a datainterface portion 1001. The interface 1001 includes an output queue 1002containing data segments 1003 to be multicast to other devices in thenetwork. The interface 1001 also has an input queue 1004 containing datasegments 1005 that have been received via multicast communications fromother devices. According to these preferred embodiments of theinvention, the communicator application 904 may include itself as arecipient of its own multicast transmission. Thus, the communicatorapplication 904 will receive the data segment it transmitted to otherdevices in the network. By determining when a recently-transmittedpacket of data is received back at the communicator application 904, thecommunicator application 904 can determine the level of traffic flow inthe network. For example, with some preferred embodiments of theinvention, the communicator application 904 may refrain from outputtinganother data segment from the output queue 1002 until it has received apreviously-transmitted data segment in its input queue 1004.

As will be appreciated by those of ordinary skill in the art, a numberof variations for this flow rate detection technique are possible. Forexample, the communicator application 904 may postpone sending a newdata segment (e.g., Data 2 shown in FIGS. 5A and 5B) until thetransmitted data segment immediately preceding it (e.g., Data 1) isreceived in the input queue 1004 (see FIG. 10B). Alternately, thecommunicator application 904 may determine an average number of datasegments in the input queue 1004 that occur between its own transmitteddata segments to ascertain the current flow conditions of traffic acrossthe network. Numerous other modifications are also possible using thereceipt of self-transmitted data segments to determine flow conditionsof traffic across the network. Further, this technique can be employedeven for communications that are not multicast. For example, thecommunicator application 904 may be able to send a copy of apoint-to-point message to itself on a feedback loop. The communicatorapplication 904 can then use the occurrence of a message in the inputqueue 1004 that the communicator application 904 has sent to itself todetermine the amount of traffic on the network.

Also, as previously explained, the same multicast transmissions can beemployed to deliver messages using both a positive-acknowledgementmulticast communication technique and a negative-acknowledgementmulticast communication technique. It should be noted that, when thenegative-acknowledgement multicast communication technique is used inconjunction with flow detection, the flow control feature used with thenegative-acknowledgement multicast technique will control the operationof the positive-acknowledgement multicast technique. That is, thesending device will not send out multicast transmissions to any device,including those devices communicating with the positive-acknowledgementmulticast communication technique, faster than permitted by the flowcontrol feature.

This flow-controlled negative acknowledgement multicast communicationtechnique may therefore preferable be provided by the communicationapplication 904 in multi-tier configurations of the invention todistribute new and updated SSL/TLS session information to the proxyservers 302 without significantly increasing the use of the network'sresources, both in terms of network traffic and in processing timerequired by the transmitting and receiving devices. Of course, thecommunicator application 904 may also provide communication techniqueswith no reliability for various administrative functions of the proxyserver 302.

Thus, by using reliable multicast communication techniques (i.e., thepositive acknowledgement multicast communication technique and theflow-controlled negative acknowledgement multicast communicationtechnique) to deliver SSL/TLS session information to multiple devices atthe same time, SSL/TLS session information for a session between a proxyserver 302 and a client computer 301 can be efficiently cached in aplurality of different cache memories 705 and cache repositories 802. Ifa connection between a client computer 301 and one proxy server 302 isterminated, another proxy server 302 can then resume the session withthe client computer using the cached SSL/TLS session information.

Although specific embodiments of the invention have been described,various modifications, alterations, alternative constructions, andequivalents are also encompassed within the scope of the invention. Forexample, in addition to storing SSL/TLS session information describedabove, other information may be conveniently stored in the cache 706.For example, if a client computer 301 and a proxy server 302 designateone or more ports used to transmit encrypted data, these ports may bestored in the cache 706 to facilitate resuming a SSL/TLS session withthe client computer 301. Also, if the client computer 301 provides theIP address and port of the target application server 303, thisinformation may also conveniently be stored in the cache 706 tofacilitate resuming a SSL/TLS session with the client computer 301.Further, for SSL/TLS sessions generated with the modified SSL/TLS, thecache 706 may store nonces exchanged during the session. Thus, if thesession is resumed with a different proxy server 302, the new server 302can detect when a datagram has already been received.

It should also be noted that the described invention is not restrictedto operation within certain specific data processing environments, butis free to operate within a plurality of data processing environments,such as a distributed computer network environment, a single stand-alonecomputer system environment, or other computing environments.Additionally, although the present invention has been described using aparticular series of transactions and steps, it should be apparent tothose skilled in the art that the scope of the present invention is notlimited to the described series of transactions and steps.

There is inherent flexibility in creating the logic, system flow,tables, and data structures used for programming the present invention.Data structures and values upon which calculations are performed may beexplicit, derived from other data, imported from other sources, orresult from program calculations or logical operations, all withoutdeparting from the spirit or limiting the scope of the invention. Thealgorithms for indexing, searching and data processing in this patentmay be substituted or modified to support various performance and/orsystems integration requirements, all without deviating from the spiritor limiting the scope of the invention.

Further, while the present invention has been described using aparticular combination of hardware and software, it should be recognizedthat other combinations of hardware and software are also within thescope of the present invention. The present invention may be implementedonly in hardware or only in software or using combinations thereof.

The specification and drawings are, accordingly, to be regarded in anillustrative rather than a restrictive sense. It will, however, beevident that additions, subtractions, deletions, and other modificationsand changes may be made thereunto without departing from the broaderspirit and scope of the invention as set forth in the claims.

Reference numerals in the appended method claims identifying steps arefor convenience only and are not intended to imply a necessary orderingof the steps. It is, therefore, to be understood that within the scopeof the appended claims the invention may be practiced otherwise than asspecifically described. No claim should be interpreted to be inmeans-plus-function format.

1. A method for establishing a secure connection for data transmissionvia a network, the method comprising: receiving a request to establish asecure session with a computer using an unreliable protocol, the requestreceived via the network; transmitting a request for cached sessioninformation from a server storing the cached session information, theserver coupled to the network; receiving cached session information fromthe server storing the cached session information; establishing a securesession with the computer using the unreliable protocol; transmittingupdated session information from the secure session to a plurality ofrecipient servers coupled to the network; determining that the updatedsession information has been received at the plurality of recipientservers; and adjusting a rate of transmission of updated sessioninformation to the plurality of recipient servers based on thedetermined receipt of the updated session information by the pluralityof recipient servers.
 2. The method of claim 1, wherein the request toestablish the secure connection includes a session identifier.
 3. Themethod of claim 1, further comprising performing a search of a localcache to locate the cached session information upon receiving therequest to establish the secure connection.
 4. The method of claim 3,wherein performing the search includes generating a search key based ona session identifier.
 5. The method of claim 2, further comprising:generating a search key upon receiving the request to establish thesecure connection, the search key generated based on the sessionidentifier; and transmitting the search key to the server storing thecached session information.
 6. The method of claim 2, wherein receivingthe cached session information further comprises: transmitting thesession identifier to the server storing the cached session information;and receiving resumption information for a session associated with thesession identifier.
 7. The method of claim 3, further comprisinggenerating a record for storage in the local cache, the record includingresumption information, an expiration date associated with the record,and the session identifier.
 8. The method of claim 3, wherein resumptioninformation includes a message authentication check algorithm, a cipherspecification, and flag information indicating that the session can beused to initiate a connection.
 9. The method of claim 8, furthercomprising: initiating the session with the computer based on the flaginformation; and generating a record for storage in a local cache, therecord including the resumption information, an expiration dateassociated with the record, and the session identifier.
 10. The methodof claim 1, wherein the cached session information includes a peercertificate.
 11. The method of claim 1, wherein the cached sessioninformation includes a data compression algorithm.
 12. A non-transitorycomputer-readable storage medium having embodied thereon a program, theprogram executable by a computer to perform a method for establishing asecure connection for data transmission in a network, the methodcomprising: receiving a request to establish a secure session using anunreliable protocol; transmitting a request for cached sessioninformation; receiving cached session information; establishing a securesession using the unreliable protocol; transmitting updated sessioninformation from the secure session to a plurality of recipient servers;determining that the updated session information has been received atthe plurality of recipient servers; and adjusting a rate of transmissionof updated session information to the plurality of recipient serversbased on the determined receipt of the updated session information bythe plurality of recipient servers.
 13. The non-transitorycomputer-readable storage medium of claim 12, the method furthercomprising transmitting a positive acknowledgement of receipt of thecached session information.
 14. The non-transitory computer-readablestorage medium of claim 12, the method further comprising transmitting anegative acknowledgement of receipt of the cached session information.15. The non-transitory computer readable storage medium of claim 12, themethod further comprising initiating a session upon establishing asecure connection.
 16. The method of claim 1, wherein adjusting the rateof transmission includes postponing the transmission of a data segmentcorresponding to the updated session information.
 17. The method ofclaim 1, wherein adjusting the rate of transmission includes determiningan average number of data segments in an input queue.